--- old/./build.gradle 2018-03-19 18:33:49.982067172 +0530 +++ new/./build.gradle 2018-03-19 18:33:49.758067172 +0530 @@ -1581,9 +1581,6 @@ // Qualified exports needed by javafx.* modules (excluding javafx.swing) def qualExportsCore = [ - "--add-exports=java.base/sun.reflect.misc=javafx.base", - "--add-exports=java.base/sun.reflect.misc=javafx.fxml", - "--add-exports=java.base/sun.reflect.misc=javafx.web", "--add-exports=java.base/sun.util.logging=javafx.base", "--add-exports=java.base/sun.util.logging=javafx.controls", "--add-exports=java.base/sun.util.logging=javafx.fxml", --- old/dependencies/java.base/module-info.java.extra 2018-03-19 18:33:50.582067172 +0530 +++ new/dependencies/java.base/module-info.java.extra 2018-03-19 18:33:50.382067172 +0530 @@ -23,9 +23,6 @@ * questions. */ -exports sun.reflect.misc to javafx.base; -exports sun.reflect.misc to javafx.fxml; -exports sun.reflect.misc to javafx.web; exports sun.util.logging to javafx.base; exports sun.util.logging to javafx.controls; exports sun.util.logging to javafx.fxml; --- old/modules/javafx.base/src/main/java/com/sun/javafx/property/MethodHelper.java 2018-03-19 18:33:51.158067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/property/MethodHelper.java 2018-03-19 18:33:50.950067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -30,7 +30,7 @@ import java.lang.reflect.Method; import java.security.AccessController; import java.security.PrivilegedAction; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Utility class to wrap method invocation. --- old/modules/javafx.base/src/main/java/com/sun/javafx/property/PropertyReference.java 2018-03-19 18:33:51.698067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/property/PropertyReference.java 2018-03-19 18:33:51.490067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -33,7 +33,7 @@ import javafx.beans.property.ReadOnlyProperty; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * A handle to a specific property defined on some {@link Bean}. --- old/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/JavaBeanPropertyBuilderHelper.java 2018-03-19 18:33:52.230067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/JavaBeanPropertyBuilderHelper.java 2018-03-19 18:33:52.030067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,8 +26,7 @@ package com.sun.javafx.property.adapter; import java.lang.reflect.Method; - -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** */ --- old/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/ReadOnlyJavaBeanPropertyBuilderHelper.java 2018-03-19 18:33:52.766067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/ReadOnlyJavaBeanPropertyBuilderHelper.java 2018-03-19 18:33:52.562067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,8 +26,7 @@ package com.sun.javafx.property.adapter; import java.lang.reflect.Method; - -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** */ --- old/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/ReadOnlyPropertyDescriptor.java 2018-03-19 18:33:53.318067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/property/adapter/ReadOnlyPropertyDescriptor.java 2018-03-19 18:33:53.098067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -34,7 +34,7 @@ import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; import static java.util.Locale.ENGLISH; --- old/modules/javafx.base/src/main/java/com/sun/javafx/reflect/MethodUtil.java 2018-03-19 18:33:53.846067172 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/reflect/MethodUtil.java 2018-03-19 18:33:53.642067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -43,7 +43,7 @@ import java.util.Arrays; import java.util.HashMap; import java.util.Map; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; class Trampoline { @@ -89,15 +89,13 @@ super(); } - /*public*/ - static Method getMethod(Class cls, String name, Class[] args) + public static Method getMethod(Class cls, String name, Class[] args) throws NoSuchMethodException { ReflectUtil.checkPackageAccess(cls); return cls.getMethod(name, args); } - /*public*/ - static Method[] getMethods(Class cls) { + public static Method[] getMethods(Class cls) { ReflectUtil.checkPackageAccess(cls); return cls.getMethods(); } --- old/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/BeanAdapter.java 2018-03-19 18:33:54.398067172 +0530 +++ new/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/BeanAdapter.java 2018-03-19 18:33:54.194067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -40,9 +40,9 @@ import java.security.PrivilegedAction; import javafx.beans.value.ObservableValue; -import sun.reflect.misc.FieldUtil; -import sun.reflect.misc.MethodUtil; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.FieldUtil; +import com.sun.javafx.reflect.MethodUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Exposes Java Bean properties of an object via the {@link Map} interface. --- old/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/MethodHelper.java 2018-03-19 18:33:54.954067172 +0530 +++ new/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/MethodHelper.java 2018-03-19 18:33:54.750067172 +0530 @@ -30,7 +30,7 @@ import java.lang.reflect.Method; import java.security.AccessController; import java.security.PrivilegedAction; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Utility class to wrap method invocation. --- old/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/builder/ProxyBuilder.java 2018-03-19 18:33:55.522067172 +0530 +++ new/modules/javafx.fxml/src/main/java/com/sun/javafx/fxml/builder/ProxyBuilder.java 2018-03-19 18:33:55.318067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -45,8 +45,8 @@ import java.util.TreeSet; import javafx.beans.NamedArg; import javafx.util.Builder; -import sun.reflect.misc.ConstructorUtil; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ConstructorUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Using this builder assumes that some of the constructors of desired class --- old/modules/javafx.fxml/src/main/java/javafx/fxml/FXMLLoader.java 2018-03-19 18:33:56.058067172 +0530 +++ new/modules/javafx.fxml/src/main/java/javafx/fxml/FXMLLoader.java 2018-03-19 18:33:55.858067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -90,9 +90,9 @@ import java.util.EnumMap; import java.util.Locale; import java.util.StringTokenizer; -import sun.reflect.misc.ConstructorUtil; -import sun.reflect.misc.MethodUtil; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ConstructorUtil; +import com.sun.javafx.reflect.MethodUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Loads an object hierarchy from an XML document. --- old/modules/javafx.fxml/src/main/java/javafx/fxml/JavaFXBuilderFactory.java 2018-03-19 18:33:56.622067172 +0530 +++ new/modules/javafx.fxml/src/main/java/javafx/fxml/JavaFXBuilderFactory.java 2018-03-19 18:33:56.426067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -63,8 +63,8 @@ import javafx.scene.text.Font; import javafx.util.Builder; import javafx.util.BuilderFactory; -import sun.reflect.misc.ConstructorUtil; -import sun.reflect.misc.MethodUtil; +import com.sun.javafx.reflect.ConstructorUtil; +import com.sun.javafx.reflect.MethodUtil; /** * JavaFX builder factory. --- old/modules/javafx.web/src/ios/java/javafx/scene/web/ExportedJavaObject.java 2018-03-19 18:33:57.194067172 +0530 +++ new/modules/javafx.web/src/ios/java/javafx/scene/web/ExportedJavaObject.java 2018-03-19 18:33:56.970067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -39,8 +39,7 @@ import java.security.PrivilegedAction; import java.security.PrivilegedExceptionAction; -import sun.reflect.misc.MethodUtil; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; // Java Object exported to JavaScript --- old/modules/javafx.web/src/main/java/com/sun/webkit/MethodHelper.java 2018-03-19 18:33:57.750067172 +0530 +++ new/modules/javafx.web/src/main/java/com/sun/webkit/MethodHelper.java 2018-03-19 18:33:57.542067172 +0530 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -30,7 +30,7 @@ import java.lang.reflect.Method; import java.security.AccessController; import java.security.PrivilegedAction; -import sun.reflect.misc.ReflectUtil; +import com.sun.javafx.reflect.ReflectUtil; /** * Utility class to wrap method invocation. --- /dev/null 2018-03-19 16:04:57.599463000 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/reflect/ConstructorUtil.java 2018-03-19 18:33:58.094067172 +0530 @@ -0,0 +1,45 @@ +/* + * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package com.sun.javafx.reflect; + +import java.lang.reflect.Constructor; + +public final class ConstructorUtil { + + private ConstructorUtil() { + } + + public static Constructor getConstructor(Class cls, Class[] params) + throws NoSuchMethodException { + ReflectUtil.checkPackageAccess(cls); + return cls.getConstructor(params); + } + + public static Constructor[] getConstructors(Class cls) { + ReflectUtil.checkPackageAccess(cls); + return cls.getConstructors(); + } +} --- /dev/null 2018-03-19 16:04:57.599463000 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/reflect/FieldUtil.java 2018-03-19 18:33:58.634067172 +0530 @@ -0,0 +1,43 @@ +/* + * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package com.sun.javafx.reflect; + +import java.lang.reflect.Field; + +/* + * Create a trampoline class. + */ +public final class FieldUtil { + + private FieldUtil() { + } + + public static Field getField(Class cls, String name) + throws NoSuchFieldException { + ReflectUtil.checkPackageAccess(cls); + return cls.getField(name); + } +} --- /dev/null 2018-03-19 16:04:57.599463000 +0530 +++ new/modules/javafx.base/src/main/java/com/sun/javafx/reflect/ReflectUtil.java 2018-03-19 18:33:59.170067172 +0530 @@ -0,0 +1,128 @@ +/* + * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + + +package com.sun.javafx.reflect; + +import java.lang.reflect.Proxy; + +public final class ReflectUtil { + + private ReflectUtil() { + } + + /** + * Checks package access on the given class. + * + * If it is a {@link Proxy#isProxyClass(java.lang.Class)} that implements + * a non-public interface (i.e. may be in a non-restricted package), + * also check the package access on the proxy interfaces. + */ + public static void checkPackageAccess(Class clazz) { + SecurityManager s = System.getSecurityManager(); + if (s != null) { + privateCheckPackageAccess(s, clazz); + } + } + + /** + * NOTE: should only be called if a SecurityManager is installed + */ + private static void privateCheckPackageAccess(SecurityManager s, Class clazz) { + while (clazz.isArray()) { + clazz = clazz.getComponentType(); + } + + String pkg = clazz.getPackageName(); + if (pkg != null && !pkg.isEmpty()) { + s.checkPackageAccess(pkg); + } + + if (isNonPublicProxyClass(clazz)) { + privateCheckProxyPackageAccess(s, clazz); + } + } + + /** + * Checks package access on the given classname. + * This method is typically called when the Class instance is not + * available and the caller attempts to load a class on behalf + * the true caller (application). + */ + public static void checkPackageAccess(String name) { + SecurityManager s = System.getSecurityManager(); + if (s != null) { + String cname = name.replace('/', '.'); + if (cname.startsWith("[")) { + int b = cname.lastIndexOf('[') + 2; + if (b > 1 && b < cname.length()) { + cname = cname.substring(b); + } + } + int i = cname.lastIndexOf('.'); + if (i != -1) { + s.checkPackageAccess(cname.substring(0, i)); + } + } + } + + public static boolean isPackageAccessible(Class clazz) { + try { + checkPackageAccess(clazz); + } catch (SecurityException e) { + return false; + } + return true; + } + + /** + * NOTE: should only be called if a SecurityManager is installed + */ + private static void privateCheckProxyPackageAccess(SecurityManager s, Class clazz) { + // check proxy interfaces if the given class is a proxy class + if (Proxy.isProxyClass(clazz)) { + for (Class intf : clazz.getInterfaces()) { + privateCheckPackageAccess(s, intf); + } + } + } + + // Note that bytecode instrumentation tools may exclude 'sun.*' + // classes but not generated proxy classes and so keep it in com.sun.* + public static final String PROXY_PACKAGE = "com.sun.proxy"; + + /** + * Test if the given class is a proxy class that implements + * non-public interface. Such proxy class may be in a non-restricted + * package that bypasses checkPackageAccess. + */ + public static boolean isNonPublicProxyClass(Class cls) { + if (!Proxy.isProxyClass(cls)) { + return false; + } + String pkg = cls.getPackageName(); + return pkg == null || !pkg.startsWith(PROXY_PACKAGE); + } +}